Skip to main content

Troubleshooting (AWS Marketplace)

Every entry here was hit on a real install.

job openbox-seed-admin-email-check failed​

global.seedOrg.adminEmail is missing, still the shipped placeholder, or not a valid address. Nothing was created.

kubectl -n openbox logs job/openbox-seed-admin-email-check
helm uninstall openbox -n openbox

Install again with --set global.seedOrg.adminEmail=you@your-company.com.

helm install hangs, then times out​

The openbox-license secret is probably missing — the license check pod waits for it indefinitely.

kubectl -n openbox get secret openbox-license
kubectl -n openbox describe pod -l job-name=openbox-license-verify-preinstall | tail -5
# "secret \"openbox-license\" not found" confirms it

Uninstall, create the secret (Install step 2), install again.

Volumes stuck in Pending​

kubectl -n openbox describe pvc | grep -A2 Events
# "no persistent volumes available for this claim and no storage class is set"

No default StorageClass. Name one explicitly — see Install → Storage class. Existing Pending claims keep their empty class, so delete them before reinstalling.

Backend stuck in Init​

Find which step failed:

kubectl -n openbox get pods -l app.kubernetes.io/name=openbox-backend-service
kubectl -n openbox logs -l app.kubernetes.io/name=openbox-backend-service -c create-organization
kubectl -n openbox logs -l app.kubernetes.io/name=openbox-backend-service -c license-verify
  • create-organization failing on a public email domain → reinstall with a company-domain address
  • license-verify reporting invalid_signature → the token was not issued for this chart's verification key; get a fresh bundle from your subscription

Saving a policy or behavior rule fails ("Internal server error")​

The backend could not publish the policy bundle. Read why:

kubectl -n openbox logs deploy/openbox-backend-service -c openbox-backend --since=5m | grep -iE 'bundle|opa build|s3|AccessDenied'
  • No S3_BUCKET_NAME / bucket errors: global.policyBundle is not set — see Install → Governance policies
  • AccessDenied: the backend writer role is missing s3:PutObject on the bundle key, or its trust policy names the wrong namespace / service account
  • OPA build failed … rego_type_error: an existing behavior rule does not compile and blocks every save; remove or fix that rule (known issue, being fixed)

OPA never loads a policy​

kubectl -n openbox logs deploy/opa-backend-service | grep -i bundle. Forbidden before the first policy save is expected. If it continues after a save, the OPA reader role cannot read the bundle key: check s3:GetObject on <keyPrefix>bundle.tar.gz and the trust policy for opa-s3-bundle-sa.

A pod stays in Init​

From chart 0.2.5, pods wait for what they depend on instead of crash-looping. The init container log says what is missing:

kubectl -n openbox describe pod POD | grep -A3 'Init Containers'
kubectl -n openbox logs POD -c check-sql-default-schema     # Temporal servers
kubectl -n openbox logs POD -c wait-temporal-namespace      # core workers, scheduler
  • relation "schema_version" does not exist or an old version: the openbox-temporal-schema-* Job has not finished — check its logs
  • password authentication failed: the openbox-gen-temporal-db secret no longer matches the database volume (see Uninstalling in Install)
  • Namespace default is not found / failed reaching server: the Temporal frontend is not up yet, or openbox-core.temporalWait.enabled=false is needed for an external Temporal with TLS or an API key

Pods restart repeatedly​

One restart of a Temporal pod right after install is normal (the services race to register). More than that is a fault: read the previous container log with kubectl -n openbox logs POD --previous.

The executor pod restarts with api_key is required​

The governance credentials secret is missing or malformed. Create openbox-executor-governance as in Install → Optional and restart the deployment.

Console loads but cannot reach the API, or sign-in is rejected​

  • public-urls.yaml must use your real domain on every line
  • global.recaptcha.disabled=true must be set if you have no reCAPTCHA keys
  • Check what the console actually received:
curl -s https://openbox-eks.YOUR_DOMAIN/runtime-env.js

It should list your VITE_API_URL, VITE_KEYCLOAK_BASE_URL and "VITE_RECAPTCHA_DISABLED":"true".

A setting in my own openbox-fe.extraEnv "disappeared"​

Helm replaces lists as a whole rather than merging them. If you add your own openbox-fe.extraEnv entries, put them in the same list as the public URL entries from Install step 3. (The reCAPTCHA switch is not affected — the chart renders it outside that list.)

ImagePullBackOff​

Confirm the nodes can reach the Marketplace registry and that the subscription is active in the account the cluster runs in.

LlamaFirewall / vllm pod stuck in Pending​

Insufficient nvidia.com/gpu — no GPU node. Harmless for the rest of the platform; add a GPU node or install with --set llamafirewall.enabled=false.

Last updated on